Milvus database secrets engine

Milvus is one of the supported plugins for the database secrets engine. This plugin generates dynamic credentials against a Milvus 2.x cluster via the Milvus Go SDK (v2) over gRPC. It also supports Static Roles.

See the database secrets engine docs for more information about setting up the database secrets engine.

Unlike the SQL-style database plugins, creation_statements is a single JSON document specifying Milvus roles to grant to the new user and/or custom role definitions with fine-grained privileges, rather than a semicolon-separated list of statements. Under the hood the plugin ensures custom roles and their privileges exist (CreateRole and Grant), creates the user (CreateCredential), and then grants each listed role (AddUserRole). Milvus limits usernames to 32 characters in 2.4+, so the default username_template is capped accordingly.

Capabilities

Plugin Name	Root Credential Rotation	Dynamic Roles	Static Roles	Username Customization
milvus-database-plugin	No	Yes	Yes	Yes

Setup

1. Enable the database secrets engine if it is not already enabled:

   $ bao secrets enable database
   Success! Enabled the database secrets engine at: database/

   By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

2. Configure OpenBao with the proper plugin and connection information. The url must point at the Milvus gRPC server address (host:port):

   $ bao write database/config/milvus \
       plugin_name="milvus-database-plugin" \
       allowed_roles="reader" \
       url="milvus.example.com:19530" \
       username="root" \
       password="Milvus123"
   Success! Data written to: database/config/milvus

   Milvus also accepts an API token (e.g. Zilliz Cloud) in place of username/password — see the API docs for details.

3. Configure a role that maps a name in OpenBao to a Milvus role-grant document to execute to create the database credential:

   $ bao write database/roles/reader \
       db_name="milvus" \
       creation_statements='{"roles":["public"]}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/reader

   Custom roles can also be defined inline under custom_roles:

   $ bao write database/roles/reader \
       db_name="milvus" \
       creation_statements='{"roles":["public"],"custom_roles":[{"name":"collection_reader","privileges":[{"object_type":"Collection","object_name":"Products","privilege":"Search"}]}]}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/reader

Usage

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate credentials.

1. Generate a new credential by reading from the /creds endpoint with the name of the role:

   $ bao read database/creds/reader
   Key                Value
   ---                -----
   lease_id           database/creds/reader/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
   lease_duration     1h
   lease_renewable    true
   password           SsnoaA-8Tv4t34f41baD
   username           v-token-reader-x7g2kf8s1a-1717000000

Milvus-specific notes

• Milvus Go SDK (v2) over gRPC: The plugin communicates with Milvus over gRPC using the official Milvus Go client SDK. url specifies the Milvus gRPC server address (host:port), e.g. milvus.example.com:19530.
• No root credential rotation: The plugin does not implement root credential rotation (database/rotate-root).
• 32-character username limit: Milvus 2.4+ rejects usernames longer than 32 characters. The default username_template is truncated to stay under this limit; if you supply a custom username_template, keep it within 32 characters.
• Partial-failure cleanup: User creation and role grants are separate client calls. If granting any role fails, the plugin drops the just-created user before returning the error, so no half-configured user is left behind.
• Custom roles and pre-existing roles: Roles defined under custom_roles are automatically created and granted privileges before user creation. Pre-existing roles listed under roles must already exist on the cluster.
• Credential rotation / UpdateUser: Milvus requires the user's old password to rotate credentials unless common.security.superUsers is configured. Because OpenBao does not retain previously-generated dynamic passwords, credential rotation is a no-op to prevent rotation failures.

API

The full list of configurable options can be seen in the Milvus database plugin API page.

For more information on the database secrets engine's HTTP API please see the Database secrets engine API page.